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WHAT IS CLAIMED 

1 . A method of analyzing frames at a node of a network by an intrusion 
prevention system executed by the node, comprising: 

reading the frame by the intrusion prevention system; 

comparing the frame with a machine-readable signature file; 

determining the frame has a frame signature that corresponds with the 
machine-readable signature file; and 

determining the machine-readable signature file has an associated squelch 
comprising a squelch threshold and a squelch period. 

2. The method according to claim 1, fiirther comprising disabling 
execution of a directive of the machine-readable signature file if a frame counter 
exceeds the squelch threshold. 

3. The method according to claim 1, ftirther comprising incrementing a 
frame counter upon determination that the frame signature corresponds with the 
machine-readable signature. 

4. The method according to claim 1, further comprising determining 
whether the squelch period has elapsed. 

5. The method according to claim 4, fiirther comprising initiating a new 
squelch period upon determining the squelch period has elapsed. 

6. The method according to claim 3, fijrther comprising determining if 
the squelch threshold has been exceed by the frame counter. 

7. The method according to claim 1, further comprising executing a * 
directive of the machine-readable signature file upon determination that the squelch 
threshold has not been exceeded. 
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8. The method according to claim 1, further comprising suppressing 
execution of a directive of the signature file upon determination that the squelch 
threshold has been exceeded. 

9. The method according to claim 8, wherein suppressing execution of a 
directive of the signature file further comprises suppressing execution of report 
generation associated with the determination that the frame signature corresponds 
with the machine-readable signature file. 

10. A computer-readable medium having stored thereon a set of 
instructions to be executed, the set of instructions, when executed by a processor, 
cause the processor to perform a computer method of: 

reading a frame; 

comparing the frame with a machine-readable signature file; 

determining the frame has a frame signature that corresponds with the 
machine-readable signature file; and 

determining the machine-readable signature file has an associated squelch 
comprising a squelch threshold and a squelch period. 

11. The computer readable medium according to claim 10, further 
comprising a set of instruction that, when executed by the processor, cause the 
processor to perform a computer method of periodically incrementing a squelch 
period timer assigned to the machine-readable signature file. 

12. The computer readable medium according to claim 11, further 
comprising a set of instructions that, when executed by the processor, cause the 
processor to perform a computer method of determining if the squelch period timer 
equals or exceed the squelch period. 

13. The computer readable mediimi according to claim 12, further 
comprising a set of instructions that, when executed by the processor, cause the 
processor to perform a computer method of: 
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re-initiating the squelch period timer upon determination that the squelch 
period timer equals or exceeds the squelch period; and 

incrementing a frame counter upon determining the frame signature 
corresponds with the machine-readable signature file. 

14. The computer readable medium according to claim 12, ftirther 
comprising a set of instructions that, when executed by the processor, cause the 
processor to perform a computer method of determining if a frame counter exceeds 
the squelch threshold. 

15. The computer readable medium according to claim 14, further 
comprising a set of instructions that, when executed by the processor, cause the 
processor to perform a computer method of suppressing execution of a directive of the 
signature file upon determination that the squelch threshold has been exceeded by the 
frame counter. 

16. The computer readable medium according to claim 14, further 
comprising a set of instructions that, when executed by the processor, cause the 
processor to perform a computer method of executing a directive of the signature file 
upon determination that the squelch threshold has not been exceeded by the frame 
counter. 

17. The computer readable medium according to claim 15, wherein 
suppressing execution of a directive further comprises suppressing execution of a 
report generation associated with the determination that the frame signature 
corresponds with the machine-readable signature file. 

18. The computer readable medium according to claim 13, further 
comprising a set of instructions that, when executed by the processor, cause the 
processor to perform a computer method of determining if the squelch is enabled. 
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19. The computer readable medium according to claim 13, further 
comprising a set of instructions that, when executed by the processor, cause the 
processor to perform a computer method of executing a directive of the signature file 
upon determining the squelch is disabled. 



